Google issues patch for desktop vulnerability


Security researchers have discovered a serious flaw in Google Inc.’s desktop software that could be used to wreak havoc on a victim’s computer.

The bug, which was made public Wednesday by Watchfire Corp., has now been fixed. While Google is automatically delivering a patch, Google Desktop users who want to be sure they are running the latest version of the software can download it here. Users should be running version 5.0.701.30540 or later, said Google Spokesman Barry Schnitt, via e-mail.

Google was first notified of the problem on Jan. 4, and produced its fix on Feb. 1, a Watchfire spokesman said Wednesday.

In addition to its bug fix, Google has added, “another layer of security checks to the latest version of Google Desktop to protect users from similar vulnerabilities in the future,” Schnitt said. “We have received no reports that this vulnerability was exploited,” he added.

Watchfire’s research underscores the danger of integrating Web-based applications with the desktop, the company said in a white paper, published Wednesday.

The flaw lies in a search parameter used by Google Desktop’s Advanced Search feature, which could be used to execute malicious JavaScript code, according to Watchfire.

For this attack to work, the criminal would have to first go through a number of steps, including hacking to find a cross site scripting vulnerability on the Web site — something that has been done several times in the past year, according to Watchfire.

If successful, however, the attack would be devastating. A criminal could search for anything on the computer or even take over the victim’s computer by tricking Google desktop into running malicious software stored on another computer, Watchfire claims.


Related Download
CanadianCIO Census 2016 Mapping Out the Innovation Agenda Sponsor: Cogeco Peer 1
CanadianCIO Census 2016 Mapping Out the Innovation Agenda
The CanadianCIO 2016 census will help you answer those questions and more. Based on detailed survey results from more than 100 senior technology leaders, the new report offers insights on issues ranging from stature and spend to challenges and the opportunities ahead.
Register Now